Steve Riley on Security : things that make me angry

Today’s spam

Steve Riley — Wed, 21 Jan 2009 21:13:31 GMT

Here’s what’s in my junk mail folder today:

What is up with all that? Apparently I sent a payment to myself, I initiated another payment to myself, I am a user of myself who’s received exclusive offers for January, and I received a payment from myself. Wow! Furthermore, an internal discussion group (IPv6) is apparently engaging in a PayPal transaction, and M & T Bank’s mailer needs to make doubly sure that I realize I’m receiving a new message.

I don’t know where to direct my ire—at the spammers who litter the Internet with their spew or at the people who still get duped by it. Spam would wither away if everyone just ignored it. But I guess enough people are lured by cheap mortgages for their penis extensions that the spammers rake in enough money to cover their costs…so sad.

The opt-out from hell

Steve Riley — Tue, 16 Sep 2008 22:22:03 GMT

One problem with making your email address available (which I will continue to do, don't worry) is that folks with something to sell assume you're interested in their stuff. To wit, let's consider an email I received today (copied, headers and all, after my griping).

Note that if I want to opt out of further communications, I have to do two separate things -- which actually becomes three things.

First I have to click the last link to opt out of future TechTarget spam. (Yes, I deleted the actual links. But certainly none of my trustworthy readers would attempt to re-subscribe me, right...? <g>
But that isn't enough -- I also have to separately opt out of future Avaya spam! (Why does the no-more-from-Avaya link live on a techtargetmail.com server? Whatever.) Clicking on that link eventually does land me on an avaya.com page, where I have to confirm my email address and indicate they don't have my permission to send me spam. Hmm, too difficult to embed my email in that link, when the other techtargetmail.com link did embed my email?
Then after submitting it, another page pops up telling me that I'll soon receive an email with additional instructions! In this email there's a link -- to avaya.com with my email address embedded -- that I must click, I guess to double plus confirm that yes, I really really really do wish never to hear from you again. Clicking that link takes me to a page that promises my "permissions have successfully been set. Thank you."

A pox on both your houses, TechTarget and Avaya. I never asked for your stuff. Go away.

Spam, my friends, is only going to get worse. It was so easy to ban junk faxes in 1991. But even those regulations were weakened in 2005. So do you really think we'll see anything even remotely logical for outlawing spam? I doubt it, unless we the citizens foment a revolt. Let's get cracking!

Received: from SVC-EXGWY-E801.partners.extranet.microsoft.com (10.251.24.242)
by tk5-exhub-c102.redmond.corp.microsoft.com (157.54.18.53) with Microsoft
SMTP Server (TLS) id 8.1.291.1; Tue, 16 Sep 2008 11:27:56 -0700
Received: from mail139-wa4-R.bigfish.com (216.32.181.113) by
mail04.microsoft.com (10.253.160.184) with Microsoft SMTP Server (TLS) id
8.1.291.1; Tue, 16 Sep 2008 11:27:55 -0700
Received: from mail139-wa4 (localhost.localdomain [127.0.0.1])    by
mail139-wa4-R.bigfish.com (Postfix) with ESMTP id 018C11184C2    for
<steriley@microsoft.com>; Tue, 16 Sep 2008 18:27:50 +0000 (UTC)
X-BigFish: ps16(zz18c1K1936K2b7wcak69jzzzz2af1jz2fh6bh5eh65h)
X-Spam-TCS-SCL: 4:0
Received: by mail139-wa4 (MessageSwitch) id 1221589667478982_28100; Tue, 16
Sep 2008 18:27:47 +0000 (UCT)
Received: from pp.techtargetmail.com (pp.techtargetmail.com [65.211.80.227])
    by mail139-wa4.bigfish.com (Postfix) with SMTP id 46566978071    for
<steriley@microsoft.com>; Tue, 16 Sep 2008 18:27:47 +0000 (UTC)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=pp.techtargetmail.com; b=iOmibOrM91/1Ugy2gj3QbWo74T2m3GuhmwxZCXJQpFT+nwRES8QKg+4vjt48SNp7WWJExG61Ge+DtnKD3KVI3KwqTKzkPRVrEBF0DCHhYot6VAG/EyEr5vb5RhBz+91yvNhbIqITzGnuQ+uBDJzyc6gU0FHfBl0Fa3S/phcPELM=;
Message-ID: <a818b044.724694.236c8ee748f7dd97.1.n.4.2971370188@pp.techtargetmail.com>
Date: Tue, 16 Sep 2008 14:27:47 -0400
thread-index: a818b044.724694.236c8ee748f7dd97.1.n.4
Reply-To: Avaya <a818b044.724694.236c8ee748f7dd97.1.n.4@pp.techtargetmail.com>
From: Avaya <Avaya@pp.techtargetmail.com>
To: Steve Riley <steriley@microsoft.com>
Subject: 7 Tips to Ensure Readiness for UC Deployment
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4133
Return-Path: a818b044.724694.236c8ee748f7dd97.1.n.4@pp.techtargetmail.com
X-MS-Exchange-Organization-PRD: pp.techtargetmail.com
Received-SPF: Pass (SVC-EXGWY-E801.partners.extranet.microsoft.com: domain
of Avaya@pp.techtargetmail.com designates 65.211.80.227 as permitted sender)
receiver=SVC-EXGWY-E801.partners.extranet.microsoft.com;
client-ip=65.211.80.227; helo=mail139-wa4-R.bigfish.com;
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.6916.600;SV:3.3.6916.813;SID:SenderIDStatus Pass;OrigIP:65.211.80.227
X-MS-Exchange-Organization-SCL: 2
X-MS-Exchange-Organization-SenderIdResult: PASS

The following message was sent to you as a subscriber to third party offers from a TechTarget property, including our network of Search sites, Bitpipe.com, CIO Decisions Magazine, Information Security Magazine, Storage Magazine, KnowledgeStorm, TheServerSide.com and/or TheServerSide.NET. To unsubscribe, see below.
____________________________________________________________

How should you evaluate the move to unified communications (UC)? Who within which parts of an organization will benefit? Will UC reduce the time to market? Read this E-Guide for answers to these questions and a better look at how the value of UC will, at first, be less of a financial issue and more of a productivity improvement issue that translates into financial benefits. Download this white paper now: http://pp.techtargetmail.com/c.asp?724694&236c8ee748f7dd97&1

When implementing unified communications, there are a number of important issues to think about and questions to ask. This E-Guide analyzes seven phases to ensure you reap the full benefits of UC in each. If you're ready to take the plunge but you're not sure your business or your infrastructure is - download this E-Guide now.

Click here to learn more: http://pp.techtargetmail.com/c.asp?724694&236c8ee748f7dd97&1

"If you do not wish to receive future promotions directly from Avaya please forward this e-mail to {link removed} ; please note that there is a separate opt-out procedure below to be removed from the list from which this email originated."
____________________________________________________________

Please do not reply to this email. To unsubscribe from all future third party offers from all TechTarget properties, simply click here: {link removed}

TechTarget | 117 Kendrick Street, Suite 800 | Needham, MA 02494

Blamestorming

Steve Riley — Fri, 12 Sep 2008 09:03:42 GMT

So, let's recap the sequence of events:

The Sun-Sentinel newspaper in Fort Lauderdale accidentally republishes a six-year-old news story about the bankruptcy of UAL. It wasn't on the home page, but instead buried somewhere inside the web site.
Google's news crawler (an automated thing, remember) finds the story and incorporates it as part of its news feed.
Investors see the story, and immediately react. When UAL's stock plunged 76% to a low of $3, Nasdaq shut down trading. Eventually trading resumed, and the stock closed at just under $11, losing about 11%.
United blamed Tribune Company (the owner of the Sun-Sentinel) for "irresponsibly" changing the date on the story and demanded a retraction.
Tribune Company blamed Google, claiming they've had issues with Google's crawler "for months."

Who will blame be shifted to next?

Look -- if people haven't realized by now that the Internet pretty much lacks a delete function, then (IMNSHO) it becomes the requirement of each and every one of us to pay close attention to what we're reading, to use our own big brains and fine-tuned bullshit detectors to suss out whether something makes sense.

Since this is my blog, I'm going to parcel out blame the way I see it:

United: 0%. If the concept of "negative blame" made any sense, then I'd actually write −∞ (that's a negative infinity, in case your character set is different than mine).
Google: 5%. How can an automated crawler know that a newly-dated story isn't really new? Well, those folks over there at Google are smart. Certainly it shouldn't be that difficult to compare a "new" article against existing ones. Content hashes won't work as a comparison tool, because the date would be included in the hash computation, thus making the hashes different anyway. Full-text comparisons? Sure, it would take a lot of horsepower. Perhaps not every "new" story needs comparison, but at least the crawler could submit to the comparator any stories that ought to be verified (say those with the word "bankruptcy" in them).
Tribune Company: 30%. Hey guys, you changed the date on the article. Don't go blaming someone else for your screw-up.
Investors: 65%. If you're using an automated news aggregator (remember, an aggregator is not a source of news) to make major financial decisions -- decisions that affect the livelihoods of thousands (maybe millions) of people -- well, you're a moron. You should know that incorrect information can be just as instantly available as correct information. Verify potentially damaging claims before engaging in reckless behavior.

What's this got to do with security? I don't know, maybe nothing directly related. But it certainly raises the question -- what if someone intentionally wanted to cause nearly permanent damage to a person or a corporation? Malicious content, disguised as "news," certainly seems to have become a potentially successful attack vector this week.

Worried about a social engineering attack on a massive scale? I suspect that what happened Monday (8 September) was the largest social engineering attack in history -- although I wouldn't classify it as intentionally malicious. Just you wait until the idea spreads.

[OT rant] Are there any home WiFi routers that DON'T SUCK?

Steve Riley — Sat, 23 Aug 2008 03:12:38 GMT

Warning: rant ahead, and names named.

When I'm not traveling, I like to work from home some days rather than endure the trek from Seattle to Redmond (although it's much better now that our own employee transit service has expanded into my neighborhood -- the existence of which is sad commentary on the availability and reliability of Seattle's public transit companies).

This means, of course, that I need fast and stable network connections. Comcast with their PowerBoost is working very well for me. But I just can't find a decent wireless router at all. My Lenovo T61p (with Intel 4965abgn adapter) just won't stay connected to my D-Link DIR-628 and IT'S DRIVING ME CRAZY! (Yes, I've tried various driver versions, from both Lenovo and Intel.)

My house is in an area with a lot of wireless activity -- sometimes I can see nine or ten SSIDs. I'm running draft N on 2.4GHz (which occupies two non-adjacent channels, currently 1 and 4), and I suspect the problem is collision interference. I could shift the router to 5.2GHz, which I probably would help, but then the rest of the computers in my house won't connect. Why, you ask? Well get this: the DIR-628 is part of D-Link's RangeBooster N family. So I stayed in the family and got two DWA-542 adapters for the desktop computers. Yet they only do 2.4GHz! Silly me, I assumed that being in the same family means full support of the router's capabilities.

I'm very tempted to replace my router again -- and I'm thinking that the best option is to get one with dual radios. That way I can move my T61p to 5.2GHz and replace the desktop adapters, while still having single-channel 802.11b/g on 2.4GHz for the Wii and my PlayStation Portable.

Now my request: tell me about your experience with home routers. What do you really like, and why? What should I buy?

FanBox: the latest in password scams

Steve Riley — Mon, 07 Jan 2008 21:09:00 GMT

Looks like spammers have found yet another way to worm (ha ha) themselves into the computers of the unsuspecting. In my junk email folder this morning, I saw this message:

From: Question It [mailto:question_it@fanboxapps.com]
Sent: Monday, January 07, 2008 2:34
To: Steve Riley
Subject: Ratul has asked you a question on FanBox
<http://ai.hitbox.com/ai?hb=DM550726CGWB&ai=EMC-FBX_Questionit_sync>
Ratul asked you a question. View the question <http://www.sms.ac/WidgetAPI/Service.ashx?version=1&Method=GoToMyWidget&FROMeUid=4ZIFG1mO1m6PfQKo06SrHw==&eWid=KO7kd3aLplJrKkBpaarhhg==&AssocData=+kt0NC6UaHnnVtU7bTsqPw==&source=ViralWidgetEmail&encemail=mygm7I2EtPGYgkjfT5Bu/3oQesFPnbnqWXKIA33YOI0=&mlid=590803540> and answer it.
FanBox.com is the web-based desktop that instantly turns every computer into your computer. It includes over 10,000 web applications and games to choose from, including the Question It application.
This email was sent by Ratul while using the Question It application on FanBox. Go here <http://profile.fanbox.com/preferences/EmailBlock.aspx> to learn more or stop receiving emails from friends using Question It. FanBox: 255 G Street #723, San Diego, CA 92101, USA
<http://www.sms.ac/WidgetAPI/Service.ashx?method=OpenEmail&FROMeUid=4ZIFG1mO1m6PfQKo06SrHw==&eWid=KO7kd3aLplJrKkBpaarhhg==&encemail=mygm7I2EtPGYgkjfT5Bu/3oQesFPnbnqWXKIA33YOI0=&mlid=590803540>

For most of the well-known marketing profiling--oops, I mean social networking--sites, I've enrolled my email addresses in their opt-out mechanisms (I simply don't care about LinkedIn, Plaxo, Facebook, MySpace, and so on). But this one seemed suspicious. I don't know anyone named Ratul, and everyone who wants to ask me questions certainly knows my email address. It raised my bullshit detector.

So after a bit of foraging I found this: http://spamhuntress.com/2007/12/15/smsac-turns-into-fanbox/. Seems like the company running FanBox got in trouble for doing this crap once before. Funny, isn't it, how you can just change your name and suddenly all your past sins evaporate! Well, not on the Internet, apparently. Your past sins can and do come back to haunt you.

When you sign up for FanBox, they ask for your permission to email everyone in your address book (FanBox knows how to talk to most webmail systems). To do this, of course, FanBox needs your password. Most people, sigh, willingly supply their passwords to any seemingly innocuous service. We all know that these services really are vile disgusting filth, the very embodiment of whatever nefarious supreme being you now strongly wish would unleash itself on FanBox and their ilk.

So in this case, I'm certainly not going to click on the link to stop receiving more emails. Rather, I'll put fanbox.com, fanboxapps.com, and while I'm at it, sms.ac in my blocked senders list. I recommend you do the same, and get the word out to your friends, too. FanBox--and anyone else who asks for your password--is evil, eeeeeevil I say.

America, wake up: stop being "security sheep"

Steve Riley — Tue, 02 Jan 2007 21:49:00 GMT

OK, I need to complain a bit here.

Yesterday I went to Best Buy to get a new digital camera. I already knew which one I wanted, so I found a sales guy, pointed to the display unit, and said, "I'd like one of these."

"Sure," he replied. He found the keys, unlocked the cabinet, pulled out a box, and said, "I'll meet you at register four."

"Eh?" I asked. "Can't I just carry it?"

"No, the policy is that I have to carry it."

"What a stupid policy," I grumbled, "treating all of your customers as if they're thieves."

Then when making the purchase with a credit card, the cashier demanded to see my ID. "Why?" I asked.

"To verify your identity."

I walked out of the store, with my camera, but not in a good mood at all. I spend a lot of money at Best Buy and I don't appreciate the assumption that I'm there to steal something. Furthermore, asking for ID during a credit card purchase is just dumb. Credit card companies really don't care who you are. Once the authorization is received, the transaction has already been processed, which includes a serious amount of "transaction authentication" to detect and reduce fraud. This is far more reliable than some clerk comparing names or -- worse -- signatures. And how come it never seems to dawn on the policy-making folk at these stores that online purchases don't require ID?

How did we get into this mess of distrust by default? My thinking followed this process:

First I blamed the September 11th terrorists. You bastards, if you hadn't done what you did, then Americans wouldn't be so afraid of strangers and so quick to assume that anyone who doesn't "look right" is a rapacious murderer.
No, it isn't the terrorists. It's the media. Owned by money-grubbing conglomerates with their lips pressed firmly against the wrinkled white flesh of the other Washington's (that's D.C.) buttocks, the media assists the politicians in their drive to keep America terrified. For when the people are terrified, they can be controlled, and even have their civil liberties illegally stripped away without nary a peep.
Finally, I realized: it's our own fault. We as free citizens have the solemn responsibility not to allow ourselves to be manipulated by those who would benefit from our sheepishness. While we citizens have no control over the media (this is a good thing) and little control over our current government (this is a bad thing), we have complete control over how we react to the tactics of both -- as well as the tactics of those who would do us physical harm.

America is paralyzed by fear, and this fear has caused us to regard with great suspicion those whom we necessarily interact with every day. The only way to move beyond this is to refuse to allow yourself to be manipulated. While you can't just refuse to show your ID if you want to buy something with a credit card or get on an airplane tomorrow, you can begin having conversations with your friends and neighbors -- help people understand that only when we all rise against the backlash will there be change. And chat up a stranger, too. In my travels around the world I've met hundreds of folks; I'm convinced that the overwhelming majority of people are kind and decent and simply looking for someone to listen to their stories. Be a listener -- it's amazing what you can learn. And little by little, we can undo the paralysis that defines life in the 21st century.

iPods spread disease?

Steve Riley — Wed, 18 Oct 2006 00:57:00 GMT

Well well. Looks like a few new iPod owners are getting infected when they attach their players to their computers. I'll quote the first paragraph from Apple's web site:

We recently discovered that a small number - less than 1% - of the Video iPods available for purchase after September 12, 2006, left our contract manufacturer carrying the Windows RavMonE.exe virus. This known virus affects only Windows computers, and up to date anti-virus software which is included with most Windows computers should detect and remove it. So far we have seen less than 25 reports concerning this problem. The iPod nano, iPod shuffle and Mac OS X are not affected, and all Video iPods now shipping are virus free. As you might imagine, we are upset at Windows for not being more hardy against such viruses, and even more upset with ourselves for not catching it.

So Apple has a quality-control problem, and they blame it on Windows? They mention that decent AV software would catch the virus, but then they become oblivious to the irony that they themselves apparently don't run any?

What's even more inaccurate in Apple's claim is that the malware isn't an actual virus. Rather than exploiting a code vulnerability to spread, it relies instead on a common configuration vulnerability -- the gullibility of humans. To encourage spreading, it creates an autorun.inf file, entices the user to execute the worm, and then looks for any mappped drives and drops itself on whatever it finds. I continue to maintain that autorun has no purpose on business computers and you should disable it at the domain level.

Apparently, someone at Apple fell for the dancing pigs and subsequently infected the equipment used in the manufacture of certain iPods. Ignoring their own problems, Apple finds it easier to blame Microsoft. That's right, blame is always preferable over responsibility.

Must be a slow news day: reporter writes 100% crap

Steve Riley — Tue, 03 Oct 2006 21:12:00 GMT

Imagine my surprise to read that Microsoft is removing NAP from Windows Vista! Does this guy actually get paid money to write this drivel? The particular folks quoted in the article all have their own agendas, of course.

News flash: we aren't dropping NAP. It's in the product now, we're actually running it on part of our own corporate network. And soon you'll get to enjoy the benefits of NAP in your own environments, too.

My blog is not a forum for advertisements

Steve Riley — Sun, 01 Oct 2006 08:17:00 GMT

It's bad enough that the blasted spammers pollute the value of blogs and open forums by hijacking them with their nefarious comments for questionable pharmaceuticals claiming to extend particular body parts. I have recently received, only via private email so far, exhortations to explore mostly unknown security products claiming to magically eliminate a variety of security pains. (OK, I'm exaggerating. I doubt magic is involved.)

I've continued to endure the spam and have kept my comments open and unmoderated indefinitely. Fortunately, Telligent is putting some additional anti-spam measures in place. But folks, please don't use my blog to sell me or anyone else any products, ok? That's what your own web sites are for. :)

F*#$!@g spam!

Steve Riley — Wed, 31 May 2006 22:31:00 GMT

Yeah, it's been a while since I've written a post, and I have some ideas I'll get to once the prep work for TechEd this year settles down a bit.

But look -- why in the world do the freaking spammers have to start targetting blogs now? I keep my comments open and unmoderated because I'm generally opposed to censorship. I really don't want to have to switch to moderated comments. But I'm getting a bit tired of the spam that appears here.

We all keep drowning in the stuff because spam works, obviously. Why? Because somebody, somewhere, is actually buying penis enlargement pills! <grumble grumble> If it's you, do us all a favor: please stop!

A CEO who should be fired

Steve Riley — Fri, 10 Mar 2006 23:51:00 GMT

So the CEO of an important customer of ours (no, I won't tell you who it is) claims to be, um, "very technical" and therefore keeps his own Windows domain and refuses to be part of the corporate forest. Go ahead, take a moment to express your astonishment; it took me about a full minute to recover my composure, too! Well, their IT is re-engineering part of the network and now has to, yet once again, figure out how to incorporate the non-standard and unmanaged "personal network" of this particular maverick.

This is a load of nonsense, as I'm sure you'll agree. No matter how I spin it mentally, I simply can't envision even a single business justification for this CEO to exempt himself from policies that everyone else is required to follow. He apparently fails to realize that his choice sends a clear message saying, in effect, "The policies suck and I know it." His behavior probably demoralizes the entire IT staff and communicates to them that he doesn't trust them and that they have no value.

Also, and probably even more important, his stance arguably increases costs to the organization. Just consider the ongoing extra (costly) work required for building the additional design, testing, troubleshooting, and support necessary to accomodate his silly whims. No worthy CEO -- one concerned with shareholder value and organizational performance -- would willingly do this. I know one company whose products I now will never buy.

What motivates a journalist?

Steve Riley — Thu, 19 Jan 2006 02:52:00 GMT

OK, I have to unload a burden here.

I often interact with the tech press in various places throughout the world. I've had wonderful, productive meetings with many fine journalists. New Zealand and Malaysia particularly stand out in my memory. However, a thing has happened today that, while not affecting my relationships with individual journalists, irritates me about tech reporting in general.

Take a look at this: "Windows Wi-Fi patch could be a long time in coming." It describes a "vulnerability" recently reported by a researcher at a security conference. c|net also wrote about this two days ago.

I'm disappointed at the seemingly superficial reporting here. Mark Loveless (the researcher) has discovered a way to confuse unsuspecting people simply by taking advantage of a feature in Windows. He has not discovered a vulnerability. There's no error in either code or the default configuration here.

Today's article implies that a bad guy can get access to any system he wants to. Thing is, the default configuration won't permit that. You have to run as local admin and deliberately misconfigure your wireless settings for a bad guy to connect to your computer -- and when you do this, Windows warns you multiple times about potential threats.

It saddens me that, rather than truly analyzing the researcher's report, the journalist simply chose to report "yet another vulnerability."

New site at the top of my favorites list

Steve Riley — Wed, 16 Nov 2005 12:46:00 GMT

You know, stupid security abounds. I just discovered this site today, and I plan to become a regular visitor -- and probably a contributor, too! I encourage you to explore it and enjoy. Oh, some advice: it probably would be unwise to read an offline archived version of this site on an airplane. :)

Stupid Security: Exposing fake security since 2003
http://www.stupidsecurity.com

The Internet routes around outages -- and censorship, too

Steve Riley — Tue, 27 Sep 2005 12:28:00 GMT

Have you seen this yet? "Grokster ruling begins the good fight" If you haven't, it's worth your time to read -- it's a terrible shibboleth for a U.S. "national firewall."

Coursey is promoting the idea that all U.S. Internet access should pass through a firewall that will block file-sharing and gambling sites. Since most of these sites have moved off-shore, Coursey claims that this isn't censorship, but it's the only way to ensure that "when the Internet is being used on American soil, it should comply with American law." Later in the article he chides the Chinese government "for filtering the Internet as delivered to residents of the communist dictatorship." He contrasts this with file-sharing and gambling and says that "since [these] are not accepted as universal human rights," it's OK to "stop illegal content from reaching American citizens."

Does Coursey lack a sense of irony? It seems so. In one swell foop he maintains that America should be allowed to filter what America has declared illegal -- file-sharing and gambling -- while denying that China should be allowed to filter what China has declared illegal -- political and religious content that's counter to and threatens the government.

Am I the only one who sees a problem with this? Now of course China's actions completely violate all sense of human rights, but adopting their solution -- censorship -- will be no better in this country. If we establish a precedent of censoring illegal content, what's to stop various interest groups from galvanizing politicians to declare illegal anything that the groups don't like? Where will it end?

(Post script: I'm writing this from Taiwan! Also, last week in China, their "national firewall" was pretty useless...)

Airport security silliness

Steve Riley — Fri, 22 Jul 2005 06:23:00 GMT

So today (Thursday 21 July 2005) I flew from Seattle to Dallas for a customer meeting. Since it's a short one-day affair, I packed my small carry-on size suitcase. In it was a pair of shoes, one pants, one shorts, two shirts, a toiletry bag, and my collection of wall warts (AC adpaters). Seems normal, so far.

As the suitcase passes through the x-ray machine, the TSA droid's brows begin to furrow. "Oh crap," thought I. They run the bag a second time. More furrowing.

"Is this your bag?" they ask. There seemed to be a bit of trepidation combined with glee in their attitude -- or maybe I was just imagining it.

"Yeah, can you tell me what's wrong?"

"There's something that we can't figure out what it is. We'll need to do a secondary screening."

So then they carry it to one of those infernal explosive detection machines. You know, where another doughnut-gorged TSA droid sticks a little chamois pad on the end of a wand and lovingly caresses your bag's zippers, then inserts the chamois pad into the detection machine. There was nothing, of course. As far as I can tell from my research, none of these machines in any airport in the United States has ever actually found an explosive. What an absolute waste of time, money, and resources.

Then -- get this -- Mr. Doughnut hands me my bag! So let me get this straight. The supposedly highly-trained x-ray operator can't figure out something inside my bag, and so they inspect the exterior zipper? What are these people smoking, and why don't they share? Sheesh! Security theater, indeed.